Operational Technology Security Service 7.4.1

The Operational Technology (OT) Security Service is introduced to help consolidate OT services under one license and to decouple the underlying definitions and packages from IoT ones. New OT-related services such as OT Detection Definitions and OT Virtual Patching Signatures used in the virtual patching profile are now licensed under the OT Security Service.

The following table provides an overview of the new Operational Technology (OT) Security Service entitlement:

7.4.0 and earlier	7.4.1 and later
Industrial Security Service entitlement Includes: Industrial Attack Definitions	Operational Technology (OT) Security Service entitlement Includes: OT Threat Definitions (renamed) OT Detection Definitions (new) OT Virtual Patching Signatures (new)

To view the entitlement information in the GUI:

1. Go to System > FortiGuard.

2. Expand the Operational Technology (OT) Security Service entry in the License Information table.

   

To view the entitlement information in the CLI:

# diagnose autoupdate versions | grep OT -A7
OT Threat Definitions
---------
Version: 6.00741 signed
Contract Expiry Date: Sat Sep 16 2023
Last Updated using manual update on Tue Dec  1 02:30:00 2015
Last Update Attempt: n/a
Result: Updates Installed

--
OT Detect Definitions
---------
Version: 0.00000
Contract Expiry Date: Sat Sep 16 2023
Last Updated using manual update on Mon Jan  1 00:00:00 2001
Last Update Attempt: Mon Aug 14 15:42:43 2023
Result: No Updates

OT Patch Definitions
---------
Version: 0.00000
Contract Expiry Date: Sat Sep 16 2023
Last Updated using manual update on Mon Jan  1 00:00:00 2001
Last Update Attempt: Mon Aug 14 15:42:43 2023
Result: No Updates

OT Threat Definitions

Users upgrading to 7.4.1 from previous FortiOS versions with an Industrial Security Service entitlement will continue to receive the OT Security Service entitlement. The existing Industrial Attack Definitions have been renamed OT Threat Definitions. These definitions include both application control and IPS signatures for OT applications and protocols.

To include or exclude the use of OT signatures in IPS and application control:

config ips global
    set exclude-signatures {none | ot}
end

The exclude-signatures setting's industrial option was renamed to ot in 7.4.1. Previously, the command options were: config ips global set exclude-signatures {none | industrial} end

To apply the OT category to an application control sensor:

1. Go to Security Profiles > Application Control.

2. Click Create New or edit an existing profile.

3. If the OT category has not been enabled yet, hover over Operational Technology and click Enable OT Signatures.

   

4. The Confirm dialog opens, noting that This will enable operational technology signatures globally. Are you sure you wish to proceed? Click OK.

5. Select the action from the dropdown for the Operational Technology category.

   

   In FortiOS 7.4.1 and later, the Industrial category is renamed to Operational Technology.

6. Configure the other application sensor settings as needed.

7. Click OK.

To view OT application signatures:

1. Go to Security Profiles > Application Signatures.

2. In the Category column, click the funnel icon and filter by Operational Technology, then click Apply.